The 'bufs' array contains 'pipe->buffers' elements, but the
fuse_dev_splice_write() uses only 'pipe->nrbufs' elements.

So reduce the allocation size to 'pipe->nrbufs' elements.

Signed-off-by: Andrey Ryabinin <aryabi...@virtuozzo.com>
---
 fs/fuse/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 74900571546d..39789f070cde 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1944,7 +1944,7 @@ static ssize_t fuse_dev_splice_write(struct 
pipe_inode_info *pipe,
        if (!fud)
                return -EPERM;
 
-       bufs = kvmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
+       bufs = kvmalloc_array(pipe->nrbufs, sizeof(struct pipe_buffer),
                              GFP_KERNEL);
        if (!bufs)
                return -ENOMEM;
-- 
2.16.4

Reply via email to